isaacs has 5 CVEs on record between 2025 and 2026. The busiest recent month was January 2026 with 3. The median CVSS is 7.5 (high). None have a confirmed exploitation report. The most common weakness class is CWE-22 (3). Most affected products: tar (4), glob (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2026-23950High· 8.8node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.348CVE-2026-29786Medium· 6.3node-tar is a full-featured Tar for Node.js47CVE-2026-23745Medium· 6.1node-tar is a Tar for Node.js46CVE-2026-24842High· 8.2node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic45CVE-2025-64756High· 7.5Glob matches files using patterns the shell uses42
isaacs vulnerabilities
CVEs affecting isaacs, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-29786Medium· 6.3PoCnode-tar is a full-featured Tar for Node.js
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables f…
CVE-2026-24842High· 8.2node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attac…
CVE-2026-23950High· 8.8node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3
node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalizatio…
CVE-2026-23745Medium· 6.1PoC⚖ disputednode-tar is a Tar for Node.js
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass…
CVE-2025-64756High· 7.5Glob matches files using patterns the shell uses
Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution …